VULNERABILITY INTELLIGENCE

CVE-2015-0285

CVSS score4.3 MEDIUM
EPSS probability4.96%
CISA KEVNot currently listed
Published2015-03-19
Last modified2026-06-17
CVSS vectorAV:N/AC:M/Au:N/C:P/I:N/A:N

Description

The ssl3_client_hello function in s3_clnt.c in OpenSSL 1.0.2 before 1.0.2a does not ensure that the PRNG is seeded before proceeding with a handshake, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by sniffing the network and then conducting a brute-force attack.

Primary references